Image hashes differ between Rebuilder instances

When I tried out the Rebuilder feature, every rebuild got flagged as invalid.

🚫 https://sysupgrade.antennine.org/

🚫 https://sysupgrade.guerra24.net/

I then generated an image from each Rebuilder and noticed that the hashes didn’t match. Diffing the images revealed the following differences:

< 00780250  64 20 62 79 20 6b 65 79  20 38 61 65 66 65 31 65  |d by key 8aefe1e|
< 00780260  62 66 35 61 64 32 63 66  38 0a 52 57 53 4b 37 2b  |bf5ad2cf8.RWSK7+| ...
---
> 00780250  64 20 62 79 20 6b 65 79  20 33 62 64 30 65 36 34  |d by key 3bd0e64|
> 00780260  34 31 36 36 66 36 63 30  38 0a 52 57 51 37 30 4f  |4166f6c08.RWQ70O| ...
489898c489898
< 00780300  72 6f 6d 00 00 00 00 00  68 b1 ea a5 84 00 00 18  |rom.....h.......|
---
> 00780300  72 6f 6d 00 00 00 00 00  68 b1 f3 34 84 00 00 18  |rom.....h..4....|
489900c489900
< 00780320  6a 93 1e 25 83 00 00 6d  00 06 70 75 62 6b 65 79  |j..%...m..pubkey|
---
> 00780320  6a 93 26 b4 83 00 00 6d  00 06 70 75 62 6b 65 79  |j.&....m..pubkey|
489903,489906c489903,489906
< 00780350  6c 64 20 6b 65 79 0a 52  57 53 4b 37 2b 48 72 39  |ld key.RWSK7+Hr9|
< 00780360  61 30 73 2b 4b 42 67 76  49 62 72 42 58 6c 62 43  |a0s+KBgvIbrBXlbC| ...
---
> 00780350  6c 64 20 6b 65 79 0a 52  57 51 37 30 4f 5a 45 46  |ld key.RWQ70OZEF|
> 00780360  6d 39 73 43 50 7a 75 62  45 52 4c 56 50 6d 69 56  |m9sCPzubERLVPmiV| ...
489909,489917c489909,489917
< 007803b0  69 67 6e 65 64 20 62 79  20 6b 65 79 20 38 61 65  |igned by key 8ae|
< 007803c0  66 65 31 65 62 66 35 61  64 32 63 66 38 0a 52 57  |fe1ebf5ad2cf8.RW| ...
---
> 007803b0  69 67 6e 65 64 20 62 79  20 6b 65 79 20 33 62 64  |igned by key 3bd| ...

Because the signing keys are included in the output, each Rebuilder instance produces a unique image. I’m not sure how best to address this, but I really appreciate the Rebuilder feature and would be grateful if this could be fixed.

Start by tracing the Rebuilder image-generation path and identify where signing keys are included in the generated output. Compare outputs from separate Rebuilder instances and determine how the build can remain reproducible without instance-specific key material. Done means equivalent rebuilds produce matching image hashes while preserving the intended signing behavior.